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Abstract 

This paper describes an aperture cover mechanism that was successfully flown in four locations on 
SDO/EVE, and is awaiting launch in sixteen locations on MMS. This design uses a paraffin actuator and a 
latch that secures the cover closed and removes the actuator from the load path. This latch allows the 
assembly to operate both as a light weight contamination cover (SDO/EVE), and also as a high-strength 
sensor restraint mechanism (MMS/SDP). The paper provides design/analysis/test information about the 
mechanism. 


Introduction 

The Solar Dynamics Observatory (SDO) EUV Variability Experiment (EVE) was launched in February 
2010, and contains four optical channels, each protected with this cover mechanism. EVE has a cooled 
(-120°C) detector, grazing incidence optics, 35-micron entrance slits, and operates in the extreme ultra- 
violet. Together, these features make this instrument extremely sensitive to particulate and volatile 
contamination. The function of this mechanism is to keep the instrument free from contamination during 
ground assembly and test through launch and initial spacecraft outgassing. 

The Magnetospheric Multiscale Mission (MMS) is a four spacecraft constellation. The Fields Investigation 
incorporates several instruments, including the Spin Plane Double Probe (SDP). The SDP instrument 
utilizes this same aperture cover mechanism; however, it is modified to restrain a preloaded sensor 
element. Both the SDO/EVE and MMS/SDP implementations of this mechanism are nearly identical. 
SDO/EVE was designed / fabricated / tested several years before MMS/SDP, but many of the design 
features are carried forward into the MMS/SDP implementation. 

Mechanism Requirements 

• Dust / contamination seal (SDO/EVE) 

• Sensor restraint (MMS/SDP) 

• One time on-orbit release - open only 

• Manual close 

• <50 lifetime releases, pre-launch 

• Design Life 500 cycles, limited by actuator 

• Cover opens 120 degrees or more 

• 1 G operation 

• Force Margin 4x on passive deployment springs 

• Redundant mechanical and electrical device 

• No metal to metal contact 

• A-thermalize design - Thermal gradient across hinge line 

• Position sensors to power off actuator 

• Window for instrument stimulus (SDO/EVE) 

• >2 Hz deployed frequency 

• Temp range -30 to +40°C, prior to actuation. 

• Survive the radiation environment of geosynchronous orbit (SDO/EVE) 
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Mechanism Mechanical Design 

A redundant torsion spring hinge line with redundant Vespel bushing surfaces is utilized. A unique latch 
restrains the mechanism for launch. A High Output Paraffin (HOP) actuator is configured in such a way 
that it expands, releases the latch, and provides a positive “kick-off force on the cover to ensure that 
deployment motion is initiated. This kickoff force overcomes possible stiction at the cover interface. 
Ground testing is eased by removing the actuator and measuring the force required to release the latch. 
When the cover opens, the end of travel catch securely stops the motion. 
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Figure 1 . SDO/EVE Aperture assembly with four aperture cover mechanisms 

Two limit switches sense cover motion and power off the HOP. The MMS/SDP implementation removed 
the limit switch from the redundant heater side, providing an innovative way to protect against the risk of 
limit switch failure, while still utilizing the limit switch to protect the integrity of the HOP before launch. 

Figure 1 shows the location of the Aperture Cover Mechanism with respect to the EVE instrument. For 
this implementation, the primary function of the mechanism is to maintain cleanliness against particulate 
and volatile contamination. 

Figure 2 shows the implementation for MMS/SDP. In addition to providing cleanliness, this mechanism 
functions to restrain the sensor element during launch. A large preload is applied to the sensor element, 
which is directly reacted by the cover and subsequently the catch. The over center latch is ideal because 
of its large load carrying capability as well as its low release force. Late in the MMS/SDP program, the 
sensor preload was significantly increased to mitigate an issue with vibration at the interface between the 
sensor-sphere and the restraint cover. This existing design handled the increased loading. 
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Figure 2. MMS/SDP Sensor Restraint Mechanism 

Figure 3 shows the mechanism deployment sequence and details of the restraint latch. During launch, the 
latch hook secures the cover. This load is directly carried by the latch into the latch pivot. The loading 
from the cover (and the pre-loaded sensor element for MMS/SDP) is never applied to the actuator. This 
arrangement allows the actuator to be physically removed during ground testing to measure how much 
force is actually required to release the cover and establish a definitive actuator force margin. The latch 
rollers, latch pivot, and leaf spring bushings are all low friction Vespel SP3. The roller directly adjacent to 
the actuator is brass which dissipates any electrical charging due to the high radiation GEO environment. 
The latch hook is contoured which allows the kickoff roller to apply a direct force to the cover in the event 
that the cover is stuck. The over-center contour at the “latch roller / latch hook” interface prevents 
inadvertent release during launch. The latch hook has a ramp which allows the cover to be manually 
reset, simply by pushing the cover closed and visually observing the latch position. 

When the cover is latched for launch, one of two limit switches is depressed. After launch, the cover is 
opened by powering the HOP. Initially it expands slightly as can be seen in Figure 3: “Released”. At this 
point, the redundant torsion springs are free to open the cover. However, the HOP is still powered, so its 
shaft will continue to axially deploy. In the event that the door is stuck, the HOP will expand until a roller is 
pushed firmly against the cover with 156 N (35 lb) of force. At the fully deployed position, the “cover 
closed switch” is released, and the “cover open” switch is engaged. Either of these events will nominally 
power off the HOP. 
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Table 1. Unique design features and benefits of this mechanism 

Feature 

Benefit 

Release latch, then “kick-off” 

Ensures motion will start, particularly at the beginning of travel. 156N 
force available from HOP ensures large force margin of safety. 

Actuator out of launch load 
path 

No side load on pin puller. Design is insensitive to increased pre-load 
on cover 

Manually open/close 

Useful feature for ground testing 

End of travel catch 

Securely holds cover in open position 

Redundant springs, bushing 
surfaces, HOP heaters 

Higher reliability 

Removable actuator 

Allowed verification of force margin 
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Figure 3. Deployment Sequence and Latch Details 


In the event of a switch failure, the microprocessor can ignore the switches in the SDO/EVE 
implementation. The MMS/SDP implementation does not use switches on the redundant side, thus 
eliminating the risk of a limit switch anomaly preventing HOP actuation. 
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The MMS/SDP mechanism opens 180 degrees. The resultant spring torque at full open is sufficient to 
hold the cover against its open stop without an end-of-travel catch. For SDO/EVE, the cover opens 
240 degrees and the spring torque at the fully opened position is small. Initial prototypes of the 
mechanism revealed 10-20 degrees of backlash of the cover when at its open position. To remedy this, 
stiffer torsion springs were used and a catch was added to hold the cover securely in the open position. 
Although this freedom of motion would not negatively affect the instrument, it would prevent the “cover 
open” switch from actuating reliably. 

Initially, the catch was designed as a thin beryllium copper sheet metal component, as shown in Figure 4. 
After several actuations, it was discovered that the bounce-back of the door was loading the end of the 
sheet metal catch in compression, causing it to buckle and yield. The catch was redesigned out of a 
machined aluminum component, pivoting on a vespel bushing, and preloaded with a small torsion spring 
(Figure 4 and 5) 

Initial catch design: Bent sheet metal Final catch design, machined components 



Figure 4. Initial and final catch designs 


Details of the final end-of-travel catch are shown in Figure 5. Only after the cover has opened 
180 degrees, and is completely outside the instrument’s glint free FOV, does the catch begin to engage 
with the cover. The location at the hinge line was selected to provide ready access to un-latch the catch, 
such that the cover could be manually closed without any disassembly or tools. 

Catch Anomaly: During mechanism run-in testing, the catch always secured all four covers in the open 
position, reliably. However, upon close inspection it was found that two of the four mechanisms had 
catches that did not in fact capture the cover as it was initially deployed, but rather allowed these covers 
to bounce back about 45 degrees, then return to the catch, at which point they were securely captured. 
Many manual deployments were completed as this phenomenon was investigated. It appeared that slight 
variations in the end-of-travel springs and limit switch springs caused the catch to not engage on the first 
cover impact, but always engage on the second cover impact. This is considered acceptable because: 
1) the catch always secures the cover in its open position, 2) the limit switches are redundant, and 3) a 
failure of the catch wound not prevent the cover from properly opening. 
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Figure 5. SDO/EVE final catch design 


Close attention was paid to the details of the hinge line, as shown in Figure 6. All moving surfaces were 
Vespel SP3, which contains MoS 2 dry lubricant. The bushings were arranged such that redundant sliding 
surfaces exist at every interface. Axial bushings are used at one end of the hinge, but the other end is 
allowed to float axially. SDO/EVE faces the sun, so it was expected that the cover may get hot and that 
the hinge needs to allow for a large thermal gradient between the cover and the mechanism. Clearances 
are tightly controlled between bushings and mating surfaces to ensure that under the worst thermal 
conditions, a clearance would exist and prevent the hinge from binding. Hinge friction was measured for 
all flight units under the full survival temperature range (details to follow). 

Thermal design features are shown in Figure 7. External metal surfaces are coated with silver composite 
coating CCaG, which prevent the cover from getting hot in direct solar illumination. This coating is 
sensitive to damage by handling, so great care was taken during mechanism assembly and test. The MLI 
attachment is considered a critical interface. Simple clamp plates are used (also CCaG coated) to 
compress the MLI securely around the apertures. 
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Figure s. Hinge Line 


MLI clamping was done to prevent any trapped particulate within the MLI from being vented at the 
aperture cover, and to prevent the MLI from obscuring the aperture. Thermally, the performance of the 
MLI is significantly reduced at this interface, but mechanically, this is very secure. 
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Thermal 
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Design 


The cover is machined AI6061T6, as shown in Figure 8. The actual seal was intended to be leaky and 
allow slow venting of the pre-launch purge N 2 . Additional larger vents are located on the instrument 
housing and they allow rapid instrument venting during launch. Viton O-rings are known to develop 
stiction, and would not allow the mechanism to slowly vent, so they are not used on this mechanism. The 
seal is fabricated from kapton tubes, fitted into dovetail O-ring grooves, and secured in place with an 
internal wire. Although this works fine, it turned out to be more complicated than necessary, and if done 
over again, they would be replaced with a simple machined Vespel seal. A window is included in the 
cover to allow for pre-launch instrument aliveness verification. 
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Figure a. Cover oesign, SDO/EVE of-travel soft stop 
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The MMS/SDP cover implementation is shown in Figure 9. The sensor sphere is titanium nitride, which 
has a known photo-emissive property. It is required that the door restrain the sphere carefully and firmly 
so that there will be no wear or transference of material that would damage the performance of the 
sensor-sphere surface and degrade the performance of the sensor. The sensor sphere was pre-loaded to 
178 N with three Ti6AI4V leaf springs and contacted through a Tecaform SD ring. 
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Figure 9. Cover Design, MM SIS DP 


Testing SDO/EVE Mechanism 

Actuator Force Margin Test: Early prototype testing (pre-PDR) was completed as a way to establish 
the force margin for the actuator and torque margin for the hinge springs. Figure 10 shows the setup and 
results of this early test. A prototype mechanism was placed in a thermal oven and purged with N 2 . The 
actuator was removed for this test and substituted with a hand held force gage to measure the force 
required to unlatch and deploy the mechanism. This wasn’t the perfect test - the oven door was opened 
repeatedly during the measurements which resulted in some frost build up. Dry ice was used to cool past 
the oven’s cold temperature capability. Although this wasn’t a perfect flight-like environment, it was 
considered very useful as a simple way to gain confidence, early in the mechanism development. The 
maximum force required to unlatch the mechanism was 6 N, which is very low considering the actuators 
156-N capability. 

Hinge line friction test: All mechanisms had hinge drag torque measurements performed during 

assembly, and had corresponding spring torque measurements completed after assembly. This verified a 
positive margin of safety for deployment torque. 

1G Orientation deployment: One of the mechanisms was deployed in all six orientations, with respect 
to gravity, with no anomalies. 
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N2 
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Aperture Cover Mechanism in 
thermal oven, with N2 purge 


Figure 10. Aperture Cover Force Margin 


Final Run-In test: All four flight mechanisms were deployed in a vacuum tank 45 times each in a matrix 
of 3 voltages and 3 temperatures for both primary and redundant windings. The deployment time was 
recorded for each actuator and typical values are noted in the table in Figure 11. The large variation in 
deployment times prevents a software time-out from being an effective method to power off the HOP. This 
result reaffirmed the necessity of end of travel switches. 



Figure 11. Run-In Test Figure 12. Switch Spring Measurements 


Switch Anomaly: During the run-in test, one limit switch on one mechanism failed to properly indicate 
“door open” after 17 cycles. If this had happened in flight, it would neither have prevented the door from 
properly opening, nor prevented the actuator from being powered off. Nonetheless, the test was paused 
and the root cause was investigated. 

Measurements of the height of the “end-of-travel” spring and the “switch spring” were made (Figure 12), 
and it was found that variations in the height of these 2 springs could prevent the switch from being fully 
depressed. The “end-of-travel” spring was shimmed to match the other mechanisms. The shimmed 
mechanism was then manually deployed 25 times in air at room temperature with zero anomalies. At this 
point, the final run-in test was resumed with no further issues. 

Vibration Testing: An early prototype installed on a mass model was vibration tested to 10.0 grms and 
acoustic tested to 142 dB. The final flight mechanisms were vibration and acoustic tested after installation 
on the flight instrument. 
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Testing MMS/SDP Mechanism 


The engineering model was vibration tested with the integrated instrument. Following the test, the cover 
was deployed 14 total times, with 1 actuation at +50°C and 3 actuations at -30°C. These deployments 
were done in thermal convection chambers. The EQM was also vibration tested on the integrated 
instrument, followed by 23 total actuations. During TVAC, the unit was successfully deployed at both cold 
and hot survival limits. To date, a total of 16 flight units have undergone vibration and thermal vacuum 
testing. The only resulting anomaly was determined during a safe-to-mate check, and was related to a 
micro-switch. During the entire test campaign there has not been any premature deployments and all 
planned door actuations have been successful. 



Figure 13. MMS/SDP Latches 


On-orbit experience 

SDO/EVE covers were successfully deployed on orbit with no issues. The MMS/SDP covers are 
integrated onto the spacecraft, ready for launch. 

Conclusion 

The SDO/EVE mechanism was a robust design that was easily scaled to a highly preloaded application 
for MMS/SDP. Building and testing the assembly early allowed for resolution of design issues associated 
with the original end-of-travel catch design. The capability of removing the actuator proved very helpful for 
testing the latch release force. Performing a run-in test over survival limits with many cycles was an 
effective way to uncover a limit switch adjustment issue, and provided a high degree of confidence in the 
design. 
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